KR101003094B1 - Cyber attack traceback system by using spy-bot agent, and method thereof - Google Patents

Abstract

The present invention relates to a network attack location tracking method and system using a spy bot agent that tracks the location of an attacker who attempts hacking without relying on the cooperation system between domains. To this end, the present invention, through the host scanning backtracking server for detecting at least one dangerous host open port vulnerable to hacking, and transmitting and installing a spy bot agent to each detected dangerous host, through the installed spy bot agent And a spy bot management server for acquiring packet information of the packets entering and leaving each dangerous host, and the backtracking server refers to packet information obtained through each dangerous host to reverse the starting point of the hacking code via the dangerous hosts. To track.

Domain, host, traceback, spybot agent, packet

Description

{Cyber attack traceback system by using spy-bot agent, and method}

The present invention relates to a method and system for tracking a network attacker's location, and more particularly, to a network attack location tracking method using a spy bot agent for tracking a network attacker's location even in a mutually exclusive and uncooperative domain environment. will be.

The present invention is derived from the research conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development. [Task Management No. 2007-S-022-02, Title: Intelligent Cyber in the ALL-IP Environment Development of Attack Monitoring and Tracking System].

An attacker (hacker) who tries to break into the target host through the network makes a lot of effort to keep his or her real network information from being revealed. The attacker accesses the target host through another host without directly accessing the target host or by bypassing an anonymous proxy server.

If an attacker passes through multiple hosts to reach the target host, the packet's starting point and target point will change each time it passes through the host used as an intermediate stop in the attacker's terminal. For example, when the attacker's terminal sends a packet to the proxy server, the IP assigned to the attacker's terminal is the starting point, and the address of the proxy server becomes the target point. However, when the proxy server transmits the packet sent from the attacker's terminal to the target host. The IP of the proxy server is the starting point of the packet, and the IP of the target host is the destination. If the attacker's hack succeeds and later the administrator of the target host examines the connection history of the target host, the administrator can only know the details of access from the proxy server.

Therefore, in order to block an attacker's network attack, it is basically important to know where the attacker is and who the attacker is. When an attacker approaches a target host for the purpose of hacking, it is required to recognize this in real time and detect the attacker's location. This is commonly referred to as traceback. TCP traceback, IP packer traceback, etc. are mainly used for the back trace. In back filtering, ingress filtering, logging, hash-based IP trace, ICMP trace, IPsec-based traceback, probabilistic packet marking technology.

On the other hand, while the above traceback method is easy to trace back between hosts belonging to a single domain, the traceback is difficult for hosts belonging to different domains. If a packet that is suspected of being hacked is transmitted from a host belonging to domain A to a host belonging to domain B, the host belonging to domain B must request information about the origin of the packet to domain A. If a suspicious packet breaks into a target host via a larger number of domains, a host belonging to domain B can obtain the attacker's actual starting point by cooperating with each domain via the packet.

However, each domain is not cooperative and often hostile to the other domain. Therefore, it is very difficult to determine the actual attacker location of a packet through several domains by the conventional traceback method. Accordingly, the present inventors propose a network attack location tracking method and system using a spy bot agent that tracks the location of a network attacker even in mutually exclusive and non-cooperative domain environments.

Accordingly, an object of the present invention is to provide a network attack location tracking method and system using a spy bot agent that tracks the location of an attacker who attempts hacking without relying on the cooperation system between domains.

In addition, another object of the present invention is to implant a spy bot agent for detecting the attacker's attack in the weak security of each of the hosts belonging to the same domain or different domains, through which the attacker by continuously monitoring the weak security To provide a network attack location tracking method and system using a spy bot agent to minimize the damage caused by.

The above object is a traceback server for detecting at least one dangerous host whose port is vulnerable to hacking through host scanning, and transmitting and installing a spy bot agent to each detected dangerous host according to the present invention. And a spy bot management server for acquiring packet information of packets entering and exiting each of the dangerous hosts through a bot agent, wherein the backtracking server comprises: each of the packets entering and exiting each of the dangerous hosts through the spy bot agent; This is achieved by a network attack location tracking system using a spy bot agent that tracks source and destination information for each host for dangerous packets that do not fall within the IP range assigned by the host.

According to the present invention, the above-mentioned object is network-connected with a plurality of hosts, is performed through a network attack location tracking system using a spy bot agent, and a hacking port is opened among the hosts by performing host scanning for each host. Determining at least one dangerous host, installing a spy bot agent for each dangerous host to obtain packet information of packets entering and leaving each dangerous host, and accessing each dangerous host through the spy bot agent. Acquiring source and destination information for each host for a dangerous packet that does not correspond to an IP range allocated by each dangerous host among the packets, and when the dangerous packet passes through the plurality of dangerous hosts, the dangerous packet Source information and destination of each of the above risk hosts for With reference to the information is accomplished by the step of tracking stations a real source information of the dangerous packets.

As described above, the present invention can identify the origin of a hack or a packet suspected to be hacked without relying on conventional non-cooperative domain cooperation.

In addition, the present invention is able to track and detect attackers in a wide range of areas by implanting a spy bot agent in a security-vulnerable place among the hosts belonging to each domain, and by obtaining packet information of packets entering and leaving each host from a remote location.

In addition, since the spy bot agent according to the present invention only detects an attacker by being implanted in a location where security is weak among hosts belonging to the conventional domain, there is no need to change the conventional network system at all.

In addition, the present invention obtains access records and attacker information for each host through each spy bot agent planted in each host, so when a security incident occurs on the host, it is easy to identify the responsible material and use it as legal evidence. Can be.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the overall conceptual diagram of a network attack location tracking system (hereinafter referred to as a reverse tracking system) using a spy bot agent according to the present invention.

The backtracking system according to the present invention is composed of a spy bot management server 200, and a backtracking server 300.

The traceback server 300 performs host scanning on hosts 11, 12, 13, and domain A belonging to the domain. The tracking server 300 determines the open ports of the hosts 11, 12, and 13 through host scanning. The traceback server 300 determines the number of open ports of each of the hosts 11, 12, and 13, and whether the ports commonly used for the penetration of hacking codes or viruses are opened.

In general, a host installed with a firewall may block ports other than a port for providing a service of the host, or require the host's permission to access a port. Otherwise, the host will most likely respond to packets sent by the traceback server 300 to check whether the port is open.

On the other hand, the host scanning of the present invention can find the vulnerable port of the host through a similar process as the hacking tool finds the host's vulnerability. Typically, the hacking tool sends packets to the ports described below and finds a suitable port for hacking through the host's response.

-Down-

80 (www), 23 (telnet), 143 (imap), 110 (pop3) [all three, or none, are probed], 111 (sunrpc), 6000 (x11), 79 (finger), 53 (domain), 31337 (unassigned by IANA), 2766 (Solaris listen / nlps_server). Of course, the backtracking server 300 may perform scanning on other ports in addition to those mentioned, and the backtracking server 300 of the present invention is a host vulnerable to hacking through a port response (hereinafter, referred to as a dangerous host). .) Or the presence of a port commonly used by hacking tools to find a dangerous host, or both.

The traceback server 300 obtains the IP of the dangerous host 10 after determining the dangerous host 10. The obtained IP is notified to the spy bot management server 200, and the spy bot management server 200 transmits and installs the spy bot agent 100 to the host 10 of the IP notified by the backtracking server 300. do. After the spy bot agent 100 is installed by infiltrating the dangerous host 10, the spy bot agent 100 acquires an administrator account of the dangerous host 10, and analyzes packets entering and exiting the dangerous host 10, thereby suspecting hacking. Find it.

Subsequently, the spy bot agent 100 transmits packet information of a packet suspected to be hacked (hereinafter referred to as a dangerous packet) to the spy bot management server 200, and the backtracking server 300 is a spy bot management server 200. After this is obtained, the transmission path of the dangerous packet is determined by referring to the source address, the MAC address, and the destination address of the packet. To this end, the spy bot agent is preferably widely distributed to each host (eg, reference numerals 10, 11, 12, 13, etc.) belonging to each domain (A, B, C). That is, the spy bot agents distributed to each host 10 to 13 notifies the spy bot management server 200 whenever a dangerous packet enters and exits its host, and the backtracking server 300

Even if the dangerous packet passes through multiple hosts (at least one of 10 to 13) and deceives the actual source information of the dangerous packet to the various hosts 10 to 13, the backtracking server 300 may not be able to access each host 10 to 13. Knowing a dangerous packet's entry and exit will immediately determine the IP packet's IP laundering (by changing or decepting the packet's IP address).

Here, the dangerous packet is

Packets attempting IP laundering via IP spoofing (packet (s) performing a SYN attack on a particular host),

Packets outside the IP range that the host uses for network communication,

A packet that hides its actual source address via a proxy server, and

-A packet that accesses a port that a hacking tool mainly uses that is not used by a normal application corresponds to this.

For IP spoofing, the real client connecting to the host should not be able to connect to the host. To do this, the attacker sends a large amount of SYN packets to the client, blocking the communication between the host and the actual client for a certain period of time. This will be described with reference to FIG. 2 together.

2 conceptually illustrates a SYN attack method for IP spoofing.

As shown, IP spoofing is a method in which the attacker C blocks communication between the host B and the client A, and performs communication with the host B on its own behalf. The attacker (C) paralyzes the client (A) by sending a large amount of SYN packets to the client (A) and prevents the host (B) from communicating with the actual client (A).

Under normal circumstances, the host B and the client A exchange SYN packets with each other, and then transmit data with each other.

Normally, only a few SYN packets are required for the host B and the client A to send and receive a single data, but when the attacker C makes a SYN attack, the host continuously runs hundreds to thousands of SYN packets. Send to (B) to block communication between host B and actual client C. The attacker C then connects to the host B on behalf of the client A by sending the appropriate ACK packet to the host B.

The traceback server 300 tracks a delivery path of a dangerous packet by referring to packet information of a packet transmitted by a spy bot infiltrating each host 10 to 13 through the spy bot management server 200. This will be described with reference to FIGS. 3 and 4 together.

First, FIG. 3 shows an example in which a dangerous packet leaves the attacker's terminal E and passes through the host F to which the attacker belongs and through the host G belonging to another domain to the destination host H. In the figure, packet information (obtained by analyzing the header of a packet) of a dangerous packet from the attacker's terminal E to the destination host H via the router L0 may be included in the source and destination addresses of the dangerous packet. (Address of host E-> address of host F), and MAC address value MAC_A of router L0.

However, if a dangerous packet is directed from host F to host G, the source address and destination address of the dangerous packet correspond to the address of host F-> host G address. Thus, as the number of hosts traversed by dangerous packets increases, the actual origin of the attacker becomes harder to determine. However, the MAC address of the dangerous packet does not change. If the spy bot agent is infiltrating each host (F, G, and H), the backtracking server 300 uses the spy bot agent to clean IP packets of dangerous packets based on the MAC address of the router (L0). It can be found that all, and can be found that the source of the dangerous packet is the terminal (E) belonging to the router (L0).

However, not all attackers expose their MACs. This case will be described with reference to FIG. 4.

4 shows an example in which an attacker invades the host N through a router.

In the figure, the attacker has penetrated the host M and host N infiltrated by the spy bot agent via the terminal J, the host K to which the attacker belongs, and the routers L1 and L2. Router L2 changes the MAC address of the dangerous packet from "MAC_B" to "MAC_C". Here, MAC_C corresponds to the MAC address assigned to the router L2 itself. When the MAC address of the dangerous packet is washed through this process, and the spy bot agent infiltrates only the host (M, N), the backtracking server 300 can track only the router L2. If the spy bot agent is infiltrated to the host K, even if the washing of the MAC address occurs, the backtracking server 300 may immediately recognize this. In other words, the spy bot agent mentioned in the present invention increases the detection capability of dangerous packets as it spreads to various hosts.

Therefore, in addition to the dangerous hosts (M, N) found by the backtracking server 300, the spy bot agent scans the surrounding network to find a new dangerous host, and duplicates itself on the found dangerous host. It is necessary to install an agent or to install a new spy bot agent by sending information of a newly discovered dangerous host to the spy bot management server 200.

5 shows an internal block diagram of a spy bot agent.

The illustrated spy bot agent includes a scanning module 110, a network information acquisition module 120, a packet analysis module 130, and a report module 140.

After infiltrating the dangerous host, the scanning module 110 performs host scanning on the neighboring host of the infiltrating dangerous host. The scanning module 110 determines the number of open ports among the ports of the peripheral host and whether the ports vulnerable to hacking are opened by the same method as the traceback server 300. As a result of the determination, when another host classified as a dangerous host is found, the result is notified to the spybot management server 200. If the newly discovered host has an operating system and conditions similar to the dangerous host infiltrated by the spy bot agent, the scanning module 110 replicates the spy bot agent infiltrated to the dangerous host and transmits it to the newly discovered host. Can be installed.

The network information acquisition module 120 obtains information on the IP range that the host uses for network communication with the peripheral client (or the peripheral host). The host has a communication port mainly used according to the type of service provided by the host, and communicates with the client (or other host) within the IP range assigned to the host or assigned by the host. On the other hand, an attacker who wants to hack often attacks using an arbitrary IP regardless of the IP range assigned to the host (or set by the host).

Therefore, the network information acquisition module 120 obtains information on a communication port or IP range mainly used by a dangerous host, and obtains the basis data for determining whether an attacker attempts a hack based on this. The network information acquisition module 120 generates information on the communication port of the dangerous host and the IP range, and stores the information in the form of data 150. The data 150 is provided in a storage device (memory or hard disk) of a dangerous host infiltrated by the spy bot agent, or transmitted to the spy bot management server 200 and stored in the form of a database in the spy bot management server 200. , And can be built. In addition, the network information acquisition module 120 obtains a LOG file that records the access history of packets entering and leaving the host.

The LOG file can be used to account for security in the event of a security incident such as a hack.

The packet analysis module 130 is based on the data 150 acquired through the network information acquisition module 120, and analyzes the header of the packet entering and leaving the host, and the analyzed packet IP corresponds to the host side IP range. Determine whether or not it is off. In addition, the packet analysis module 130 determines whether the IP of the packet entering and leaving the host corresponds to the address of the proxy server predefined in the data 150, and requests a specific MAC address according to the request of the spy bot management server 200. Whether the packet has an entry and exit, and the entry record can be provided to the spybot management server 200 through the report module 140.

The report module 140 communicates with the spy bot management server 200, and the dangerous packet determined by the packet analysis module 130 to the spy bot management server 200, the source address of the dangerous packet, the destination address, and the MAC address. Send the, and host LOG files.

The report module 140 transmits the information (IP) about the new dangerous host found by the scanning module 100 to the spy bot management server 200.

In addition, the report module 140 may determine whether a packet corresponding to the MAC address or IP address notified by the spy bot management server 200 exists, and a connection path (source address, destination address) of the packet to the packet analysis module ( 130 and notify the result from the packet analysis module 130 may be provided to the spybot management server 200.

6 is a flowchart illustrating a network attack location tracking method using a spy bot agent according to the present invention.

The backtracking system according to the present invention comprises a spy bot management server 200 and a backtracking server 300. Of course, the backtracking system according to the present invention may be implemented in a form in which the two servers 200 and 300 are integrated into one. Therefore, the network attack location tracking method using a spy bot agent according to the present invention may be any one of a server integrated into one, or a server partitioned into two servers (200, 300), the operation concept is the same, separately It is not explained separately.

First, the backtracking system performs host scanning with a host located in each domain (S401). The traceback system can determine the number of open ports of each host and whether ports are vulnerable to hacking through host scanning. Hosts that have many open ports or open ports that are vulnerable to hacking are classified as dangerous hosts, and the traceback system obtains IP information of the corresponding dangerous hosts (S402). Next, the backtracking system transmits the spy bot agent to the acquired IP, and the spybot agent infiltrates to the IP indicated by the backtracking system (S403), and acquires the administrator authority from the compromised dangerous host (S404). Acquisition of administrator authority is performed by a normal virus or hacking code, and it may seem strange that a spy bot agent according to the present invention performs the same function. The spy bot agent only needs administrator privileges to acquire the network information of the host and examine the dangerous packets entering and leaving the host, and does no harm to the host itself. Next, the spy bot agent analyzes packets entering and leaving the host, detects dangerous packets suspected of hacking, obtains a LOG file that records the details of packets entering and leaving the host, and transmits them to the spy bot management server 200 ( S405). In this case, it is preferable that the spy bot agent performs data communication with the backtracking system using a communication method that is not well used, such as an XML socket communication method, instead of the TCP communication method mainly used by the host.

1 is a conceptual diagram of a network attack location tracking system using a spy bot agent according to the present invention;

2 conceptually illustrates a SYN attack for IP spoofing,

3 is a diagram conceptually illustrating an example in which a dangerous packet leaves the attacker's terminal and passes through the host to which the attacker belongs to the destination host through a host belonging to another domain;

4 is a diagram illustrating an example in which an attacker intrudes into a host through a router;

5 is a conceptual block diagram of a spy bot agent, and

6 is a flowchart illustrating a network attack location tracking method using a spy bot agent according to the present invention.

* Description of the symbols for the main parts of the drawings *

100: spy bot agent 110: scanning module

120: network information acquisition module 130: packet analysis module

140: Report Module 200: Spybot Management Server

300: traceback server

Claims (10)

A backtracking server that detects at least one dangerous host whose ports are vulnerable to hacking through host scanning; And A spy bot management server configured to transmit and install a spy bot agent to each detected dangerous host, and obtain packet information of packets entering and exiting each dangerous host through the installed spy bot agent; The backtracking server, Source and destination information for each host is tracked for dangerous packets that do not correspond to an IP range allocated by each dangerous host among the packets entering and leaving each dangerous host through the spy bot agent. Network attack location tracking system using agents. The method of claim 1, The spy bot agent, A network information acquiring module for acquiring information on an IP range used by the dangerous host for network communication; A packet analysis module for determining whether an IP of a packet entering and leaving the dangerous host corresponds to the IP range; And And a report module for notifying the spy bot management server when the IP of the packet entering and leaving the dangerous host leaves the IP range. The method of claim 2, And a data storage module having IP information about the proxy server. The packet analysis module, And determining whether the originating IP of the packet entering or leaving the dangerous host corresponds to the proxy server and notifying the spy bot management server of the result. The method of claim 2, The spy bot agent, Perform host scanning to at least one other host belonging to the same domain as the dangerous host, And a scanning module for determining whether to open a communication port vulnerable to hacking through the host scanning and notifying the spy bot management server of the network attack location tracking system using a spy bot agent. The method of claim 4, wherein The spy bot management server, A network attack location tracking system using a spy bot agent, characterized in that for transmitting a new spy bot agent to another host that is open to the communication port vulnerable to hacking by the host scanning of the spy bot agent. The method of claim 2, The network information acquisition module, In the risk host, it is checked whether any security patch has been performed, the type of security patch installed, or whether an antivirus is installed, and informs the spy bot management server of the result of the inquiry through the report module. Network attack location tracking system using spy bot agent. The method of claim 2, The network information acquisition module, And when the SYN packets destined for the dangerous host are continuously applied in excess of a predetermined number, notifying the spy bot management server of the network attack position tracking system using the spy bot agent. Networked with multiple hosts, performed via a network attack localization system using a spy bot agent, Performing at least one host scanning for each of the hosts to determine at least one risk host whose hacking port is open; Installing a spy bot agent on each of the dangerous hosts to obtain packet information of packets entering and leaving the respective dangerous hosts; Acquiring source information and destination information of each host for dangerous packets that do not correspond to an IP range allocated by each dangerous host among packets entering and leaving each dangerous host through the spy bot agent; And And backtracking the actual source information of the dangerous packet by referring to the source information and the destination information of each dangerous host for the dangerous packet when the dangerous packet passes through the plurality of dangerous hosts. Network attack location tracking method using a spy bot agent. The method of claim 8, Acquiring the source information and destination information, Acquiring information on any one of whether the threat host performs the security patch, the type of the security patch installed, and whether the vaccine is installed through the spy bot agent; How to track network attack locations. The method of claim 8, The reverse tracking step, Using the spy bot agent, characterized in that the step of determining the homogeneity of the dangerous packet via each of the dangerous host on the basis of the MAC address included in the dangerous packet, and tracking the origin of the dangerous packet. How to track network attack locations.

Images